Privacy Policy
Last updated: 28 August 2026
This policy explains how Underwater Solutions BV handles personal data in the UWS platform: the web
application at app.auws.be and the UWS mobile app for iOS and Android. Both are
operational tools used to plan diving jobs, record underwater inspections and produce the resulting
reports. They are not consumer products.
1. Who we are
Underwater Solutions BV is the data controller for the personal data described here.
| Company | Underwater Solutions BV |
|---|---|
| Address | Krimperslaan 4D, 9140 Temse, Belgium |
| Enterprise / VAT number | BE 0671.693.029 |
| info@antwerpsolutions.com | |
| Phone | +32 3 771 59 99 |
| Website | www.antwerpunderwatersolutions.com |
For any question about this policy or about your personal data, write to info@antwerpsolutions.com with "Privacy" in the subject line.
We have not appointed a Data Protection Officer. Our core activity is commercial diving rather than large-scale monitoring, so the conditions in Article 37 GDPR do not apply to us.
2. Who this policy is about
We process personal data about four groups of people:
- Our own staff: divers, dive supervisors, standby divers, tenders and office personnel who use the platform or are named in job records.
- Client contacts: the people at shipping companies, agents and yards who commission our work.
- Vessel crew: masters, captains, chief officers and chief engineers who sign off on work carried out on their vessel.
- Other people on site: anyone who attends a toolbox meeting or is named in a safety document for a job.
3. Where the data comes from
Most of it we collect directly. Our staff enter it, or you give it to us when you sign a document.
Some of it reaches us from someone else. If you are a vessel's master or a client contact, your name and role often come to us through the vessel operator, the agent or the client who booked the job, before we ever meet you. We also import client company and contact details from our invoicing platform. We process this to carry out the job and to produce the inspection report the client is entitled to. The categories are the ones listed in section 4, and the rest of this policy applies to you exactly as it does to everyone else.
4. What we collect
Account data. Name, email address, hashed password, role and permissions.
Job and vessel data. Vessel name, IMO and MMSI numbers, berth and location of the work, dates and times, and the name of the vessel's captain. Vessel identifiers are not personal data in themselves, but they sit alongside the names of the people involved.
Client contact data. Company name, contact name, email address, postal address, telephone number and VAT number, used to plan work and to invoice it.
Personnel and working time. Who performed which role on a job (diver, standby diver, supervisor, tender, diver medic), the vehicle used, and departure, start, end and arrival times.
Diving records. Dive logs and per-diver dive data: bottom depth, time on the bottom, dive duration, surface interval, breathing gas mix, decompression stops completed, time out of decompression, cumulative oxygen exposure, whether a chamber was used, and the pre-dive checks completed, including a confirmation that the diver was fit for the task. See section 5 for how we treat this.
Signatures. The platform captures handwritten signatures on tablets and phones, from our own personnel and from vessel and client representatives, on safety procedures, toolbox meeting records, diving agreements, worksheets and inspection reports. Each signature is stored as an image alongside the document it belongs to, which is the point of it: it evidences who agreed to what, and when. We treat these as ordinary handwritten signatures and not as biometric data, because we do not analyse them to identify anyone.
Photographs. Underwater and topside photographs of hulls, propellers, rudders and anomalies, taken with the device camera or chosen from its gallery. They document the condition of a vessel. People are not the subject, but a photograph taken on a working deck can incidentally include someone.
Photograph metadata, including location. The app does not ask for location permission and we do not track where you are. However, photographs uploaded from a mobile device are stored as taken, so where your device's camera has embedded location coordinates in the image file, those coordinates are stored with it. We do not read, index or use this information; it is a property of the file. If you do not want it recorded, turn off location tagging in your device's camera settings.
Safety and incident notes. Free-text remarks in safety checklists, hazard observation cards and accident or incident fields. These are short operational notes, but a note written after an incident can mention an injury and so describe someone's health.
What we do not store. We do not hold diving medicals, fitness-to-dive certificates, logbooks, certification numbers or their expiry dates. Those are checked on site and only the fact that they were sighted is recorded. We do not hold dates of birth, national registry numbers or identity document details.
Technical and audit data. Every change to a job, report or safety document is logged with the user who made it, the IP address, the browser or app user agent, the URL, and a timestamp. This is how we can show that a report has not been altered after signature. Signature images and photographs are deliberately excluded from these logs.
Request diagnostics. To trace faults, the platform keeps a short-lived record of each request it receives: the user, the URL, the request content, and for the mobile app its version, the device model and the operating system version. These records are deleted automatically after 24 hours. Section 6 describes what the app sends.
What we do not collect at all. No advertising identifiers. No analytics or behavioural tracking. No payment card details. No data about children, since the platform is used only by working professionals.
5. Diving exposure data and your health
The dive data in section 4 describes how your body was exposed on a given dive: depth, duration, breathing gas, decompression, oxygen loading and chamber use. Recording it is a condition of working safely and is required by the rules governing commercial diving. To the extent that it counts as data concerning health under Article 9 GDPR, we process it under Article 9(2)(b), because it is necessary to carry out our obligations in the field of employment law and social security, together with the Belgian welfare-at-work legislation that applies to diving operations. The same basis covers any health information that appears in an accident or incident note.
We do not use this data to assess anyone's general health, we do not share it with insurers for underwriting, and we do not use it in any automated decision-making. Access is limited to the supervisors and office staff who need it to plan and document diving work.
6. The mobile app
The UWS mobile app is a field tool built to work offline on a quayside or a vessel.
Permissions it asks for. Camera, to photograph inspection findings. Photo library, to attach photographs already taken. On Android it additionally needs internet access. It never requests location, contacts, microphone or calendar access.
Data stored on the device. Job data you are working on is cached locally so the app
keeps working without a signal, and is synchronised with app.auws.be when a connection
returns. Your login token is held in the device's secure storage, which is the iOS Keychain or the
Android Keystore. Signing out or uninstalling the app removes this local data from the device.
Records already synchronised remain in the platform.
What the app tells our server about itself. Every request the app makes carries the app version and build number, the platform (iOS or Android), the operating system version and the device model, for example "Google Pixel 8 Pro". We use this to reproduce a fault on the same kind of device and to see which installations still run an old version. It contains no serial number, advertising identifier or any other value unique to your device.
Third parties in the app. None. The app contains no analytics SDK, no crash-reporting SDK and no advertising SDK. It sends no push notifications and stores no push token. It talks to our own servers and to nothing else. If you use the app's share or email function, the file is handed to the app you choose, and that app's own policy takes over from there.
7. Why we process it, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Plan and carry out diving and inspection jobs | To deliver the service our client contracted | Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest for client and crew contacts |
| Produce inspection reports, worksheets and certificates | The client is entitled to a documented result | Art. 6(1)(b) contract |
| Record safety procedures, toolbox meetings, LMRA and SHOC | Diving is regulated work and we must document that safety steps were taken | Art. 6(1)(c) legal obligation (Belgian welfare-at-work legislation) |
| Keep dive logs and per-diver exposure records | Required occupational-safety documentation for commercial diving | Art. 6(1)(c) legal obligation; Art. 9(2)(b) for health aspects |
| Capture signatures on documents | To evidence that a procedure was agreed and work accepted | Art. 6(1)(c) legal obligation; Art. 6(1)(f) legitimate interest in provable records |
| Manage accounts and secure the platform | Only authorised people should reach operational data | Art. 6(1)(f) legitimate interest in security |
| Keep an audit trail of changes | To keep signed records trustworthy and to investigate incidents | Art. 6(1)(f) legitimate interest in record integrity |
| Diagnose faults in the platform and the mobile app | To see which app version and kind of device a failing request came from | Art. 6(1)(f) legitimate interest in a working service |
| Invoice completed work | To be paid, and to meet accounting law | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation |
Where we rely on legitimate interest, we have weighed it against your interests. The data is professional rather than private, it is limited to what the job requires, and it is used only in connection with the work you were part of.
Our staff's data is processed because employment and safety law require it, not on the basis of consent. Consent between an employer and an employee is rarely freely given, and we do not pretend otherwise.
8. Who else sees the data
We do not sell personal data and we do not use it for advertising.
We share it with:
- The client who commissioned the job. Inspection reports, safety documents and signed worksheets go to the client, which is the purpose of producing them.
- Our hosting provider, which runs the platform and its database.
- XVE.Agency BV (Asiadok-Oostkaai 28F, 2030 Antwerp), our development partner, which maintains and supports the platform and may see production data while fixing a fault. XVE acts as our processor under a written agreement and on our instructions only.
- Billit, our invoicing platform. Client company and contact details are imported from it into the platform, and invoicing for completed work is carried out there.
- Our email provider, for transactional messages such as password resets and for sending reports and exports on request.
- Public authorities, insurers or lawyers, where the law requires it or where we need to establish or defend a legal claim, for example after an incident.
Each supplier acting on our behalf is bound by a data processing agreement under Article 28 GDPR and may use the data only for the service they provide to us.
9. Where the data is kept
Personal data is stored and processed within the European Economic Area. If any supplier needs to process data outside the EEA, we will allow it only under an adequacy decision or the European Commission's Standard Contractual Clauses, with additional safeguards where they are needed.
10. How long we keep it
| Data | Retention |
|---|---|
| Job records, inspection reports, safety documents and the signatures on them | 10 years after completion of the job, matching the decennial liability period for marine and construction works and the evidentiary life of a signed report |
| Dive logs and per-diver exposure records | For the period required by the diving and welfare-at-work rules applicable to the work |
| Client and invoicing data | 7 years, the Belgian statutory retention period for accounting records |
| User accounts | For as long as the person works with us, then closed. The account record is retained while signed documents still refer to it |
| Change and audit logs | For the life of the record they secure |
| Request diagnostics (app version, device model, operating system, request details) | 24 hours, then deleted automatically |
Job records are deliberately long-lived. A signed inspection report is the evidence of a vessel's condition on a given date, and removing the names from it would destroy its value as evidence. Where a record no longer serves that purpose, we delete it.
11. How we protect it
Personal accounts and passwords control who reaches the administration platform, and each account only reaches what its role allows. Traffic between the apps and our servers is encrypted with HTTPS. Passwords are stored hashed and never in readable form. Mobile login tokens are held in the device's secure storage and expire automatically. Every change to an operational record is logged with its author, and signature images and photographs are excluded from those logs.
No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights, we will tell you and notify the Belgian Data Protection Authority as required by Articles 33 and 34 GDPR.
12. Cookies
The web application sets only the cookies it needs to work: a session cookie that keeps you logged in, a CSRF token cookie that protects forms against cross-site request forgery, and a "remember me" cookie if you choose that option. All are strictly necessary and none is used to profile you.
We use no analytics, advertising or social media cookies, which is why you are not asked for cookie consent. The mobile app uses no cookies.
13. Your rights
Under the GDPR you may ask us to:
- Access the personal data we hold about you, and receive a copy
- Rectify data that is inaccurate or incomplete
- Erase your data, where we have no continuing legal or contractual reason to keep it
- Restrict processing while a dispute about accuracy or legitimacy is resolved
- Port data you gave us, in a structured, machine-readable format
- Object to processing based on legitimate interest, on grounds relating to your particular situation
Some of these rights are limited in practice. We cannot remove a signature from a safety document that regulation requires us to keep, or delete an inspection report that is still within its retention period. Where we cannot act on a request, we will tell you why.
To exercise any of these rights, email info@antwerpsolutions.com. We will respond within one month, and we may ask you to confirm your identity first so that we do not disclose your data to someone else.
14. Complaints
If you are unhappy with how we have handled your data, tell us first, since most issues are quicker to resolve directly. You also have the right to lodge a complaint with the Belgian supervisory authority, the Data Protection Authority:
Gegevensbeschermingsautoriteit / Autorité de protection des donnéesDrukpersstraat 35, 1000 Brussels, Belgium
contact@apd-gba.be · +32 (0)2 274 48 00
www.gegevensbeschermingsautoriteit.be
If you live or work in another EU country, you may complain to your own national authority instead.
15. Changes to this policy
We will update this policy when the platform or the law changes. The date at the top always shows the current version. If a change materially affects how we use your data, we will notify affected users through the platform rather than relying on you to check this page.